GDPR
Processor · DPA signed before processing
Home/Trust
The trust layer, shown.
Every claim on this site has receipts. Audit chain, GDPR posture, EU AI Act register, certifications, sub-processors — all in one place.
Certifications
What we can show you.
What we hold, and what we do not. Where an artifact exists we will send it under NDA; where one does not, the card says so.
EU AI Act
Decisioning mode · human review
Hosting
Frankfurt · AI calls not EU-pinned
Audit chain
HMAC-SHA256 · per-org keys
Isolation
Per-tenant, enforced in the ORM
SOC 2
Not certified · readiness in progress
The Audit Chain
Every event hashed, linked, verifiable.
Each transformation appends a hash-chained entry, keyed per organisation with HMAC-SHA256. Evidence packs are signed with Ed25519 and can be checked offline. The rows below are an illustrative example, not live data.
Compliance Posture
One row per regulator.
Where each regime fits in, stated as it stands today.
GDPR
DAVA is a processor, not a controller — you remain the controller of your data. DPA on request. Right-to-erasure cascades to derivatives and to stored files, and the erasure certificate reports partial coverage rather than claiming completeness it did not achieve. The application and database run in Frankfurt; see Deployment tiers for where object storage and AI calls go.
EU AI Act
Decisioning mode records reviewer attribution and rationale on automated decisions, and the record is hash-chained. We do not yet publish an Annex III high-risk register; if your deployment is high-risk under Annex III, that classification is yours to make and we will support it with the decision records.
HIPAA
Not supported today. We sign no BAA, and we do not ship Safe Harbor or Expert Determination de-identification. The underlying controls — tenant isolation, hash-chained access records, retention enforcement — exist and are documented, but do not treat DAVA as HIPAA-ready on that basis.
DORA
Sub-processor register published below and kept current. We do not run scheduled operational-resilience testing, and we do not ship incident-reporting templates. Our incident process is documented and available under NDA.
SOC 2 / ISO 27001
Not yet certified. We say so here rather than let procurement discover it. Readiness work is in progress; the underlying controls — tenant isolation, hash-chained audit, retention enforcement, sandboxed execution — are built and documented today, and we will share that documentation under NDA.
Sub-processors
Who else touches the data.
Updated 2026-10-08. Every vendor here may process customer data. This list is maintained by hand; status-page and uptime-check vendors are left out because they receive no customer data. Ask for change notices when you sign the DPA.
Deployment
Where it runs.
Three tiers. The difference that matters for a security review is how far the data travels, so that is what each row states.
Managed (EU)
We run it. Application servers in Frankfurt and Postgres in eu-central-1. Object storage is on Cloudflare R2, not pinned to an EU jurisdiction. AI features send text to Anthropic's API, which is not pinned to the EU, so that text can leave the EU.
Inference is billed to us unless you attach your own model key.
Self-host
Docker bundle with a licence key and a first-run wizard. Your database, your object storage, your network. We never see the data.
You supply your own model key; unset means LLM features are simply off.
Air-gapped
Self-host with a local inference server (Ollama) instead of a hosted model, so the deployment makes no outbound calls at all.
Local models are materially weaker than Sonnet. We have not yet published a benchmark, so size this with us rather than assuming parity.
Availability
Live status.
Uptime and incident history, hosted independently of us so it stays readable when we are the thing that is down.
Want the full trust pack?
DPA, security documentation, sub-processor change feed, and our decision-record format. We send the bundle under NDA — usually same-day.